ClawAIMail MCP Server

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:47 AM UTC
• Version: 0.2.0

Overview

This is a coherent email MCP skill, but it needs review because it can read/send/delete real email and has weak safeguards around deletion, endpoint configuration, and unpinned runtime execution.

Install only if you are comfortable giving this MCP server a ClawAIMail API key that can access mailbox data and send or delete email. Use a dedicated, revocable key and test inboxes where possible, pin the npm package to a reviewed version, keep the base URL at the verified ClawAIMail HTTPS endpoint, and require explicit human approval before sending email or deleting an inbox.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: mcp.json:4
• Finding: Unpinned npm Package Execution Through npx## Vulnerability Details **File Location**: `mcp.json:4-5`; also documented in `SKILL.md:47-48` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code `mcp.json:4-5`: ```json "command": "npx", "args": ["clawaimail-mcp"], ``` `SKILL.md:47-48`: ```json "command": "npx", "args": ["clawaimail-mcp"], ``` ### Technical Analysis The recommended MCP configuration executes `clawaimail-mcp` through `npx` without specifying an exact version. If the package is not already available locally, `npx` can resolve and download the current package release from the npm registry at execution time. Consequently, the code executed by this configuration may differ from the version that was statically audited. The included `package-lock.json` does not constrain the version independently resolved by this `npx` command. This creates a supply-chain exposure if the npm publisher account, package, registry resolution process, or a future package release is compromised. The repository also contains inconsistent project versions: `package.json` and `server.json` identify version `0.1.1`, `package-lock.json` identifies the root package as `0.1.0`, and `SKILL.md` identifies version `0.2.0`. This inconsistency makes it harder for users to establish which source revision corresponds to the downloaded artifact. ### Attack Path 1. An attacker compromises the npm publisher account or package release process for `clawaimail-mcp`. 2. The attacker publishes a modified release containing malicious startup code. 3. A user starts the MCP server using the documented unversioned `npx clawaimail-mcp` configuration. 4. `npx` resolves and downloads the attacker-controlled release. 5. The malicious package executes with the operating-system permissions and environment inherited from the MCP host. 6. The process may access the configured `CLAWAIMAIL_API_KEY` and any other resources available to the host ...[truncated 573 chars]
• Remediation: ## Remediation Suggestions - Pin the executable to an exact reviewed version, for example: ```json "command": "npx", "args": ["--yes", "clawaimail-mcp@0.1.1"] ``` - Prefer installing dependencies through a reviewed lockfile with `npm ci`, then execute the locally installed binary rather than resolving it dynamically on every launch. - Verify package integrity and provenance during release and installation. - Keep the versions in `package.json`, `package-lock.json`, `server.json`, and `SKILL.md` synchronized. - Use automated dependency and publisher-account monitoring, protected npm publication credentials, and provenance-enabled releases. - Review dependency updates before changing the pinned version.

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:6
• Finding: API Credential Can Be Forwarded to an Arbitrary Configured Origin## Vulnerability Details **File Location**: `index.js:6-18`; the override is documented in `README.md:18-20` **Vulnerability Type**: Unrestricted credential destination and unsafe endpoint configuration **Risk Level**: Medium ### Vulnerable Code `index.js:6-18`: ```js const API_KEY = process.env.CLAWAIMAIL_API_KEY; const BASE_URL = process.env.CLAWAIMAIL_BASE_URL || 'https://api.clawaimail.com'; async function api(method, path, body) { const opts = { method, headers: { 'Authorization': `Bearer ${API_KEY}`, 'Content-Type': 'application/json' } }; if (body) opts.body = JSON.stringify(body); const res = await fetch(`${BASE_URL}${path}`, opts); return res.json(); } ``` `README.md:18-20`: ```json "env": { "CLAWAIMAIL_API_KEY": "pb_your_api_key", "CLAWAIMAIL_BASE_URL": "https://api.clawaimail.com" } ``` ### Technical Analysis The server accepts `CLAWAIMAIL_BASE_URL` without validating its scheme or hostname. Every API request then attaches `CLAWAIMAIL_API_KEY` as a bearer token and sends it to the configured destination. A modified configuration can therefore direct authenticated requests to an attacker-controlled server. The code does not require HTTPS, reject embedded credentials or unusual URL components, or restrict the destination to the documented ClawAIMail API hostname. If an `http://` endpoint is selected, the bearer credential and request contents may also be exposed to network interception. A base URL override can be useful for controlled development or self-hosted deployments, but unrestricted production use exceeds the minimum destination privileges required for the declared hosted ClawAIMail service. ### Attack Path 1. An attacker persuades a user to install a modified MCP configuration, supplies a malicious setup example, or otherwise alters `CLAWAIMAIL_BASE_URL`. 2. The variable is set to an attacker-controlled endpoint, such as `http ...[truncated 1067 chars]
• Remediation: ## Remediation Suggestions - Remove the base URL override from production builds if only the hosted ClawAIMail service is supported. - Otherwise, parse and validate the endpoint before constructing requests: ```js const parsedBaseUrl = new URL( process.env.CLAWAIMAIL_BASE_URL || 'https://api.clawaimail.com' ); if ( parsedBaseUrl.protocol !== 'https:' || parsedBaseUrl.hostname !== 'api.clawaimail.com' ) { throw new Error('Invalid CLAWAIMAIL_BASE_URL'); } ``` - Use an explicit hostname allowlist if multiple trusted service endpoints are required. - Reject non-HTTPS endpoints, URL-embedded credentials, unexpected ports, and ambiguous URL forms. - If custom development endpoints are necessary, require a separate explicit development flag and use a non-production API credential scoped to that environment. - Validate that `CLAWAIMAIL_API_KEY` is present before starting the server rather than transmitting `Bearer undefined`. - Document that users must not accept untrusted MCP configurations or change the endpoint without verifying its ownership. - Use narrowly scoped and revocable API keys where the service supports them, and rotate any credential suspected of having been used with an untrusted endpoint.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

MCP Config Access

High

• Category: Agent Snooping

Content

### Claude Code / Cursor

Add to your MCP config (`~/.claude/mcp.json` or Cursor settings):

```json
{

• Confidence: 95% confidence
• Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The code substantially aligns with the core email-infrastructure claim: it creates inboxes, sends emails, lists/reads messages, searches emails, deletes inboxes, and retrieves account information via an MCP server. However, the declared description also claims broader capabilities—managing threads, REST API, webhooks, and WebSocket streaming—that are not represented in this code chunk. Because these are material product capabilities rather than minor implementation details, the description overstates what the supplied code actually does.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The `delete_inbox` tool performs irreversible deletion of an inbox and all associated messages with no visible confirmation, preview, or safety interlock. In an AI-agent setting, this materially increases the chance of accidental or prompt-induced destructive actions leading to permanent loss of potentially sensitive communications.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: fast-uri 3.1.0 is reported vulnerable to URI parsing ambiguities including host confusion and SSRF-related edge cases. For an email infrastructure skill that may consume webhook URLs, callback URLs, or remote resource references, incorrect URI normalization can directly weaken origin validation and outbound request safety.

Known Vulnerable Dependency: hono==4.12.5 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: hono 4.12.5 carries numerous advisories affecting cookie handling, routing, and request processing behavior. Because this skill is described as an MCP-enabled email infrastructure with APIs/webhooks/streaming, framework-level parsing or routing flaws are more dangerous than in an offline tool and may enable auth bypass, path confusion, or unsafe response generation depending on usage.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: ip-address 10.1.0 has advisories involving parsing inconsistencies and XSS in HTML-emitting helpers. In a service that may validate client IPs, webhook sources, or rate-limit identities, IP parsing ambiguities can undermine security controls; the XSS angle matters if any diagnostic/admin UI renders library-produced HTML.

Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

High

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: path-to-regexp 8.3.0 is flagged for ReDoS-style denial of service through crafted route patterns or inputs. Since this skill likely runs an HTTP API for mail operations, a remotely reachable route-matching bottleneck can allow attackers to tie up CPU and degrade or block service.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README advertises capabilities to read, send, search, and delete email without warning users about the privacy sensitivity of mailbox access or the destructive nature of deletion. In an MCP/agent context, this can lead users to grant broad email access to autonomous tools without understanding the risk of data exposure, unintended outbound messages, or irreversible mailbox changes.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documents use of environment variables and network-connected email operations but does not declare any explicit tool scope or permissions boundaries. In an agent environment, this increases the risk of overbroad execution, unclear trust assumptions, and accidental exposure of secrets or external communications without informed approval.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill enables sending real emails and reading inbox contents through an external service, yet it does not warn users that prompts, recipients, message contents, and mailbox data may leave the local agent boundary. This can lead to privacy breaches, accidental disclosure of sensitive information, and unexpected real-world actions if users assume the skill is sandboxed or simulated.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documented delete_inbox capability is destructive and irreversible, but the skill provides no warning or confirmation guidance. In agent-driven workflows, this can result in permanent loss of messages and operational records from mistaken prompts, prompt injection, or automation errors.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The send_email tool sends recipient addresses, subject lines, and message bodies to a remote API, which is a privacy- and action-sensitive network operation. While the tool name indicates its purpose, this file contains no confirmation prompt, user-facing disclosure, or cautionary comment that the provided content will be transmitted externally.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill exposes a destructive `delete_inbox` capability that irreversibly removes an inbox and all messages, but there is no visible safeguard, confirmation step, or narrowing of scope in the code. In an agent context, hidden destructive actions are dangerous because a prompt-injected or mistaken agent action can cause permanent data loss without clear user awareness.

Description-Behavior Mismatch

Low

• Confidence: 80% confidence
• Finding: The manifest focuses on email infrastructure operations such as inboxes, messages, threads, webhooks, and streaming. The account_info tool retrieves account metadata, plan limits, and usage information, which is administrative/account-management functionality not stated in the description.

Known Vulnerable Dependency: @hono/node-server==1.19.11 — 2 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode)

Low

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: The lockfile pins @hono/node-server 1.19.11, and the reported advisories affect static file serving path handling and middleware behavior. Even though this package-lock alone does not prove the vulnerable code path is used, a real MCP/email service commonly exposes HTTP endpoints, so shipping a known-vulnerable version is a legitimate supply-chain risk.

Known Vulnerable Dependency: body-parser==2.2.2 — 1 advisory(ies): CVE-2026-12590 (body-parser vulnerable to denial of service when invalid limit value silently di)

Low

• Category: Supply Chain
• Confidence: 70% confidence
• Finding: body-parser 2.2.2 is flagged for a denial-of-service condition involving invalid limit handling. In a network-facing service that processes HTTP request bodies, malformed requests could potentially consume resources or crash request handling, though the impact is limited to availability.

Known Vulnerable Dependency: qs==6.15.0 — 3 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u); CVE-2026-82562 (qs array-limit bypass via bracket-key comma parsing)

Low

• Category: Supply Chain
• Confidence: 72% confidence
• Finding: qs 6.15.0 is associated with low-severity denial-of-service and parsing edge cases. If this service accepts attacker-controlled query strings or serializes untrusted structures, malformed input could trigger crashes or excessive work, but the likely impact is limited and depends on actual exposure.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"url": "https://github.com/joansongjr/clawaimail"
  },
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.0.0",
    "zod": "^3.22.0"
  },
  "files": ["index.js"]

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.0.0",
    "zod": "^3.22.0"
  },
  "files": ["index.js"]
}

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: index.js:6